“Is it safe?” is one of the first questions I get asked about AI. It’s a good question. You’re responsible for your customers’ information, your staff and your reputation. You should ask it.
The short answer: AI can be used safely in a small business, as long as it’s set up with a bit of care. Most of the risks are easy to manage once you know what they are. Here’s a simple checklist to work through.
Please note: this is general information to help you think things through, not legal advice. Every business is different. If you handle sensitive information, like health or financial records, it’s worth getting advice that fits your situation.
1. Know what the Privacy Act expects
In New Zealand, the Privacy Act 2020 sets the rules for how businesses handle personal information. That means any information about an identifiable person, like a customer’s name, email, phone number or the details of their job.
The Act doesn’t ban AI. But the same rules apply whether a person or a tool is handling the information. In plain terms, that means:
- only collect and use personal information for a clear, fair reason
- keep it secure
- check it’s accurate before you rely on it
- be careful about sending it to other organisations, including overseas
- let people see and correct the information you hold about them
The Office of the Privacy Commissioner has published guidance on AI for NZ businesses. It’s worth a read, and it’s free on privacy.org.nz.
Check: Do you know what personal information your team might put into an AI tool?
2. Use business tools, not free personal accounts
This is the single biggest and easiest win.
Many free, personal AI accounts may use what you type to help improve their systems, unless you change the settings. Business and team versions of the main tools, like ChatGPT, Claude and Microsoft Copilot, generally don’t train on your data by default, and give you more control over who can see what.
The details differ between tools and change over time, so always check the current terms for the one you choose. But as a simple rule:
If it’s for work, use a business account. Not a staff member’s free personal login.
Check: Is your team using business accounts that you control? Or a mix of personal logins nobody keeps track of?
3. Keep a person in charge
AI is very good at writing things that sound right. But it can still get facts wrong, misunderstand a request, or make something up with total confidence.
That’s why the safest setup is simple: AI drafts, a person checks. Before anything goes to a customer, a supplier or into your accounts, someone on your team reads it and approves it.
This matters most for anything involving:
- prices, quotes and invoices
- legal, health or safety information
- promises to customers
- decisions about people, like hiring or performance
Once your team has used a tool for a while and trusts it, some very low-risk jobs, like sorting emails into folders, can run on their own. But start with a human check on everything.
Check: For each way you use AI, is it clear who checks the result?
4. Be careful what goes in
Even with business tools, it’s good practice to put in only what the AI needs to do the job.
- Leave out personal details that aren’t needed. “Reply to a customer asking about delivery times” often works just as well without the customer’s name and address.
- Be extra careful with sensitive information, like health details, bank numbers or anything about children.
- Never paste in passwords or login details.
Check: Does your team know what they should and shouldn’t put into AI tools?
5. Write a one-page AI use policy
This sounds formal, but it doesn’t need to be. A good AI policy for a small business fits on one page and is written in plain English. It should cover:
- Which tools are approved, and that work happens on business accounts
- What can and can’t go in, especially personal and sensitive information
- Who checks the results, and for which kinds of work
- Being upfront with customers where it matters, for example if a chatbot is answering questions on your website
- Who to ask when someone isn’t sure
The point isn’t paperwork. It’s making sure everyone on the team is on the same page, so nobody has to guess.
Check: If a new staff member started tomorrow, would they know your rules for using AI?
6. Train everyone, not just the keen ones
Most AI problems in small businesses aren’t caused by the technology. They come from someone not knowing the rules, or using a tool in a way nobody expected.
A short, friendly training session fixes most of that. Show your team the approved tools, walk through the policy, and practise on real tasks from your business. Make it okay to ask questions. People who feel confident make better choices than people who feel nervous.
Check: Has everyone who uses AI at work had some training? Do they know who to ask?
Your quick checklist
- We know what personal information might go into AI tools.
- We use business accounts that the business controls.
- A person checks AI work before it goes out.
- We only put in what’s needed, and nothing sensitive without care.
- We have a one-page AI use policy.
- Everyone using AI has been trained and knows who to ask.
If you can tick most of those, you’re in a good place. If not, don’t panic. Each one is a small, simple step, and you can work through them one at a time.
Want a hand?
Every setup I do comes with my Safe AI promise: your people stay in charge, your data stays yours, and everything is written down in plain English. If you’d like help working through this checklist, book a free AI chat.
Let’s make AI work for your team
Book a free 30-minute AI chat. No jargon, no pressure, just a friendly look at where AI could help your people do their best work.